CVE-2007-0017

The record

Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.

Affected packages

Related vulnerabilities

• CVE-2012-1775 Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote… Also affects vlc
• CVE-2011-0531 demux/mkv/mkv.hpp in the MKV demuxer plugin in VideoLAN VLC media player 1.1.6.1 and… Also affects vlc
• CVE-2008-5036 Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow… Also affects vlc
• CVE-2008-5032 Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow… Also affects vlc
• CVE-2008-4654 Stack-based buffer overflow in the parse_master function in the Ty demux plugin… Also affects vlc
• CVE-2008-3794 Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c… Also affects vlc
• CVE-2008-1881 Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC… Also affects vlc
• CVE-2008-1489 Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows… Also affects vlc